Kerberos constraint delegation for SharePoint 2010 SP1 and SQL Server 2012 Reporting Services (Named Instance)
- Tutorial
There is the following configuration:
1. SharePoint 2010 SP1 with installed SQL Server 2012 Reporting Services
2. SQL Server 2008 R2 with Named Instance on which the database is spinning, from which we need to take information for generating reports. SQL Server 2012 is set by Article
3. Additional parameters:
-House: test.com
-name instance of SQL: the SP
-uchetnaya record for instance: svcSQL
task : to make it all work using Kerberos
proceed
1. Create an account in the Active Directory for the Claims to Windows Token Service (for example, svcC2WTS) and give it the following rights on the SharePoint server:
-Act as part of the operating system
-Impersonate a client after authentication
-Log on as a service
AND we will add it to local admins
2. In the SharePoint admin center, you need to register the created account as a Managed Account and start the Claims to Windows Token Service (/_admin/Server.aspx).
Also, the application pool, which is used to run SQL 2012 Reporting Services Service Application , worked from a registered Managed accountfor C2WTS. You can view and change these settings on the Service Accounts page (/_admin/FarmCredentialManagement.aspx)
3. Also, then there were no problems, change the dependencies for the Claims to Windows Token service :
4. Restart SharePoint
5. On the SQL server, set the static port for instance of SQL under the article Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager)
For example, I have port 1234
Why it is necessary, it is described in detail here
6. Register SPN: You can read more about registering SPN for the sequel here - this fake SPN
7. In Active Directory Users and Computers, configure delegation for the svcC2WTS account.
On the Delegation tab, select Use any authentication protocol and add the newly registered SPNs for the sequel services. It is important that both entries are reflected in this tab.
8. Create a new Data Source with a named instance of SQL. To connect, we use windows authentication (integrated) or sharepoint user and enjoy a successful connection
1. SharePoint 2010 SP1 with installed SQL Server 2012 Reporting Services
2. SQL Server 2008 R2 with Named Instance on which the database is spinning, from which we need to take information for generating reports. SQL Server 2012 is set by Article
3. Additional parameters:
-House: test.com
-name instance of SQL: the SP
-uchetnaya record for instance: svcSQL
task : to make it all work using Kerberos
proceed
1. Create an account in the Active Directory for the Claims to Windows Token Service (for example, svcC2WTS) and give it the following rights on the SharePoint server:
-Act as part of the operating system
-Impersonate a client after authentication
-Log on as a service
AND we will add it to local admins
2. In the SharePoint admin center, you need to register the created account as a Managed Account and start the Claims to Windows Token Service (/_admin/Server.aspx).
Also, the application pool, which is used to run SQL 2012 Reporting Services Service Application , worked from a registered Managed accountfor C2WTS. You can view and change these settings on the Service Accounts page (/_admin/FarmCredentialManagement.aspx)
3. Also, then there were no problems, change the dependencies for the Claims to Windows Token service :
sc config c2wts depend= CryptSvc4. Restart SharePoint
5. On the SQL server, set the static port for instance of SQL under the article Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager)
For example, I have port 1234
Why it is necessary, it is described in detail here
6. Register SPN: You can read more about registering SPN for the sequel here - this fake SPN
setspn -A MSSQLSvc/server_fqdn:SP test\svcSQL
setspn -A MSSQLSvc/server_fqdn:1234 test\svcSQLsetspn -A SP/SRSS test\svcC2WTS7. In Active Directory Users and Computers, configure delegation for the svcC2WTS account.
On the Delegation tab, select Use any authentication protocol and add the newly registered SPNs for the sequel services. It is important that both entries are reflected in this tab.
8. Create a new Data Source with a named instance of SQL. To connect, we use windows authentication (integrated) or sharepoint user and enjoy a successful connection
